[pcap-ng-format] The "scope" of the Name Resolution Block

[Guy Harris]

On Sep 1, 2015, at 7:53 AM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:

> If its scope is only the local SHB section:
> 
> - Then as a capture device, you'd have to repeat it for each section
> in a file, if you add new sections (due to things like interfaces
> going away or their local IPs changing due to DHCP, since the only
> means we have of doing that is by adding SHBs).

That's a bug.

What we *should* have is an Interface Update Block, which has, as its fixed data, an interface ID, followed by the same options that an Interface Description Block has, indicating what interface properties changed.  Perhaps it should also have a time stamp to indicate *when* the information changed.

I'd vote for "scope is the local SHB section" plus "Interface Update Block so we don't need to create a new section just because an interface changed its IP address".